Overview

overview

8

Static

static

3

be6625f586...18.exe

windows7-x64

8

be6625f586...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    be6625f5860aa850b0bdb64e20ed0470_JaffaCakes118

  • Size

    96KB

  • Sample

    240824-mgyyfawaka

  • MD5

    be6625f5860aa850b0bdb64e20ed0470

  • SHA1

    e119fc7df6b5aba1532036ec9ff1e4c272a894ec

  • SHA256

    4f8efb06b87a3de503fffca4dadb353bb0b695a4a3d93f96138a89f2c7d1e383

  • SHA512

    b3adf6ddd4aae8395d6c5207860276f538ee1ecee9139073249652bc148686bf73b5699e42d99f430fb44f7b46537370e77f52ac63306d3c2e77bcaf2fa25411

  • SSDEEP

    768:ty837t4FkXJREBku3/nK5xa/24/ki8qkM7B1YlhrIWYHLxqu+TPW1Kljl9nnyQOo:l4PSuPKTBZrO/A5Qr+TOn+eWQ8qM+q

Score
8/10
defense_evasiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      be6625f5860aa850b0bdb64e20ed0470_JaffaCakes118

    • Size

      96KB

    • MD5

      be6625f5860aa850b0bdb64e20ed0470

    • SHA1

      e119fc7df6b5aba1532036ec9ff1e4c272a894ec

    • SHA256

      4f8efb06b87a3de503fffca4dadb353bb0b695a4a3d93f96138a89f2c7d1e383

    • SHA512

      b3adf6ddd4aae8395d6c5207860276f538ee1ecee9139073249652bc148686bf73b5699e42d99f430fb44f7b46537370e77f52ac63306d3c2e77bcaf2fa25411

    • SSDEEP

      768:ty837t4FkXJREBku3/nK5xa/24/ki8qkM7B1YlhrIWYHLxqu+TPW1Kljl9nnyQOo:l4PSuPKTBZrO/A5Qr+TOn+eWQ8qM+q

    Score
    8/10
    discoveryevasionpersistencedefense_evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks